maestro/CHANGELOG.md

Changelog

All notable changes to MAESTRO are documented here. The format is loosely based on Keep a Changelog, and the project aims to follow semantic versioning.

Unreleased

Added

• Files open in floating windows that stay on top of whatever you are doing — dragged by the title bar, resized from the corners, snapped to a screen edge, up to eight at once, with position and size kept when you move to another chat. A file the agent is writing or editing opens by itself and streams in, badged "generating / unsaved" until the write lands, or aborted, failed or approval-pending when it does not (2026-09-17).
• Workspace apps can be added from a local HTML file — "Add app" in the Apps tab installs it under apps/{name}/index.html, takes the display name from the document title, and lists anything in the page (downloads, file pickers, new windows) that the sandbox may not allow (2026-09-17).
• An LLM log tab shows every request and response — timestamp, purpose, step, model, token counts, duration, tools called — and opening a row reveals the prompt, the reply, tool arguments and tool results separately. The same transcripts are written to the chat's logs/ with a configurable retention (default 30 days), and filtering and full-text search cover the whole archive rather than the rows on screen (2026-09-17).
• The trace tab gained per-call graphs (cache hit rate, context size, prompt load time, generation speed), a "time by activity" table breaking duration down by tool, by LLM purpose and by step, a record of every compaction, and a summary of what the last reflection learned with a before/after diff of memory (2026-09-17).
• Chats can be spun off from text you select in a message or a Markdown preview, into this workspace or another, with the quoted passage passed as reference material rather than as instructions. The agent can be asked to spin a topic off as well (SpinOffTask, off by default); it inherits your ownership and visibility, and spinning off into a different workspace asks you to approve first (2026-09-13).
• Admins can read the audit log in the UI and export every record matching the current filter as JSONL, streamed rather than held in memory (2026-09-13).
• Running workers is easier to see and configure: per-worker cards with live state, endpoint auto-fill, a connection type for hosted OpenAI-compatible services (health-checked against /v1/models, API key sent), per-worker image/audio/video capability, per-worker context limits, and automatic routing of a task to a suitable model. Worker and node status moved into a floating panel reachable from any screen, showing free slots, who holds them, and per-node throughput (2026-09-13).
• Speech runs both ways: live transcription of microphone and system audio in its own tab with a running translation beside the original, a Voice mode that takes spoken instructions and shows listening / working / waiting as a character expression, and a Speak tool that turns text into an audio file playable in place. The two endpoints are configured separately and Speak is off by default (2026-09-12).
• The .xlsx preview is a spreadsheet: colors, fills, borders, column widths and row heights render as they are in the file, formulas are recalculated, and cells can be edited in place with a ribbon for bold, text color, fill, borders, alignment, row height and number format. Columns can be inserted and deleted, cells merged and unmerged, edits save by themselves, and a selected range can be handed to the agent with "Ask the agent" (2026-09-12).
• A grounded answer mode restricts the reply to workspace material and the pages fetched for that turn, prints [S1]-style markers linked to source cards, and says so when the material does not contain the answer. It can be chosen per message and set when creating a task (2026-09-12).
• Reading long documents got easier: a collapsible table of contents in the Markdown preview, export of a Markdown preview to HTML with its styling, Outlook .msg preview, and page-range reads for PowerPoint and email the way PDFs already worked (2026-09-11).
• The task overview is now a dashboard — mission goal, current focus, what is done and what is left, with constraints and decisions collapsed — plus elapsed time, measured tool calls, compaction count, worker and recent generation speed. Values that were never measured say so instead of showing a zero (2026-09-10).
• Files tab: deleted files and folders go to a Trash and can be put back, with a second explicit confirmation before anything is erased for good; files the agent writes keep a version history with a colored diff and a "restore this version" action; and the list can be filtered by name, by category, by the task that produced a file, or down to this task's files, with search covering subfolders (2026-09-09).
• Delegate and subtask runs have their own tabs, with their conversations and full outputs readable rather than truncated (2026-09-08).
• Admins can change the outbound network mode, the allow list and server-side traffic observation from Settings without restarting; deployments that pin these in an external config file are told why the fields are read-only. Fonts, the editor and the map library are served by the application itself instead of third-party CDNs (2026-09-08).
• Chats get a short name generated for them and the list shows it above the request text, and a new Activity screen lists the chats you can see across every workspace you belong to, newest activity first. Hidden and archived workspaces stay out of it (2026-09-08).
• Navigation moved to a vertical icon rail on the left edge, with search in the top bar; inside a chat the pane rail sits on the right. The rail folds away on narrow windows and opens with a swipe, and the previous horizontal tab bar can be restored in Preferences (2026-09-05).
• Human verification (CAPTCHA) is no longer a dead end: the solve screen and its login state are per workspace and shared with that workspace's members, a card appears in the chat that was blocked, "Resolved (continue)" restarts every chat waiting on that screen at once, a task that cannot reach an answer any other way parks and frees its worker instead of failing, and "Skip" proceeds without solving (2026-09-05).
• Notifications and reminders collect behind the bell across workspaces, with 90 days of history, upcoming reminders, and a count of what happened while the app was closed. The agent can create and cancel reminders, calendar events can carry a "notify N minutes before", and workspace editors can add, edit and delete calendar events (2026-09-05).
• Chat is a four-column layout — icon rail, conversation, selected pane and open files — with keyboard-movable splitters, and the conversation stays visible whatever pane you select. Opening files in a column rather than a window is a preference (2026-09-01).
• The agent can edit Office documents in place instead of regenerating them: Excel values, formulas, cell formats, merges, column widths and number formats — charts, pivot tables, conditional formatting, macros and other sheets survive, and a save that would disturb untouched cells is aborted — Word paragraphs including documents with tracked changes, and PowerPoint text (2026-09-01).
• Model reasoning is visible and kept: a reasoning panel in chat, dictionary lookups and document Q&A, shown only when the current run actually produced reasoning, still readable after the tool call that followed it, and recorded so it can be read back later (2026-08-27).
• A run that keeps thinking without producing any text or tool call is rewound and resent once its reasoning passes a character limit ("Max Thinking", default 100000, 0 to disable), with a single short nudge appended. This only works on backends that return reasoning in a separate field (2026-08-25).
• Workspaces can connect an external file store — SharePoint, OneDrive or Box — scoped to one folder, read-only, through your own account, and the agent can list the permitted locations and the names directly under them. Every connection is logged and admins have a kill switch (2026-08-20).
• Whether the command sandbox may reach the network is a per-workspace setting (inherit / allow / block; blocked by default, owner-only, logged), and whether isolation is actually in force is shown in Settings → Safety, as a badge on the workspace and task headers when commands can reach out, and recorded per job and per command (2026-08-20).
• A per-user cap on concurrently running tasks (default 1 for users, 2 for admins, 0 for unlimited) stops one person's queue from filling every slot. Tasks over the cap are passed over rather than failed, and worker slots are now shared across every feature that needs a model (2026-08-18).
• Whole tool groups can be switched off for a deployment through tool_packs.disabled in config.yaml — X, YouTube, maps, Amazon, transcription, text-to-speech, Microsoft Learn search and slide generation. A disabled group disappears from the agent and from the workspace tool list; the change is applied at startup (2026-08-15).
• Webhook notification delivery (Discord, Teams and similar) has a Settings section for enabling delivery, the public URL and the sending limits, so a workspace no longer registers a destination and watches test sends fail for no visible reason. Failures are separated into "delivery disabled", "rejected by the endpoint" and "could not be reached" (2026-08-12).
• A2A: external agents can fetch a run's output files from a link, a delegation can only target workspaces you can write to, and admins can enable or disable A2A from Settings without a restart (2026-08-10).
• Pages the agent opens are kept along with the images they contained, under source/ in the workspace, with limits on how many and how large — 20 images and 5MB each by default, adjustable in Settings (2026-08-10).
• Selecting text in a message or a Markdown preview opens a selection menu (on by default) offering a short explanation of the passage or a web-backed lookup with sources (2026-08-09).
• Admins can set instructions that apply to every user's agents, and a workspace can carry automation rules that add instructions, deny an operation, or require your approval before a tool runs or before the agent finishes. Rules are off by default, and those that fire show up in the chat (2026-08-03).
• The agent can list the other chats in the workspace newest-first (ListWorkspaceTasks) as well as search them. Search defaults to "any of these words" ranked by relevance, with an all-words filter available, and a phrase written without spaces that matches nothing is retried word by word (2026-07-24).
• A Discord connector (beta) joins Slack: mention the bot in a Discord server and it runs a task and replies with the result. The bot token is registered under Settings → chat connections; a dedicated private channel and least-privilege permissions are recommended (2026-07-21).
• A compact Movement Map in chat shows the current step, completed work, retries, and user messages without taking over the conversation. Nodes can be used for navigation, while concise tooltips explain each step (2026-07-12).
• Slack channel connections can be managed from Settings, including channel-to-workspace bindings and reliable mention ingestion and replies. Reminders and in-app notifications make scheduled and background work easier to follow (2026-07-12).
• Chat now provides per-task model and reasoning-effort selection, plus prompt coaching before sending follow-up instructions (2026-07-11).
• Research pieces (research / sns-research / sns-deep-sweep) now write date-stamped outputs (e.g. output/report-2026-07-09.md, output/deepdive/2026-07-09/) so repeated runs in a persistent workspace accumulate instead of overwriting the previous report. The agent system prompt now always includes the current date/time (2026-07-09).
• Draft autosave for the new-task dialog, chat composer, feedback comments, and continue instructions — text survives an accidental close or reload. Files can be attached by pasting (Ctrl+V) into the new-task dialog (2026-07-09).
• Settings: a "Skill quotas" section plus editors for several previously config-file-only options (max stream time, subtask debounce, summary headroom, .msg size limit, TLS minimum version, worker health-check interval) (2026-07-09).

Changed

• The trace tab no longer lists individual records. What remains is the graphs, the time-by-activity table and the compaction record; prompts, replies and tool results are read in the LLM log tab, which the trace tab links to (2026-09-17).
• Viewers can no longer start new chats, and workspace editors can now delete files — deletion became reversible with the Trash, so there was no longer a reason to separate who may edit from who may delete (2026-09-09).
• Chat and scheduled-run visibility is no longer chosen per item from private / organization / public. Who can see a chat follows from its owner and the members of the workspace it lives in, which is how it already behaved inside a workspace, and the route that let such a chat be switched to public after creation is closed. Chats outside a workspace keep their current visibility (2026-09-08).
• Settings are fully localized: field labels, section names, sub-headings and the settings search all appear in the interface language, as do task states and the remaining English strings elsewhere in the UI (2026-09-07).
• A follow-up to a finished chat passes the previous exchange verbatim by default instead of a summary, so file contents and decisions survive at the cost of a larger request; the history icon in the composer switches back to a compacted hand-off, per chat. Summarization still applies where verbatim cannot be trusted — old chats with no transcript, a shared log directory, a turn sent with grounded answers on, and re-runs after a failure (2026-08-28).
• A server whose Bash sandbox is set to auto refuses to start when the isolation mechanism (bwrap) is unavailable, rather than starting unprotected while the settings still claim outbound traffic is blocked. Install bwrap to enforce it, or set safety.bash_allow_network: true to accept the risk; the startup error names both routes and the setting that stopped the boot. off still starts with a warning (2026-08-27).
• The A2A issuer must be the exact public URL with the pathname /oidc — a trailing slash or any other shape stops A2A from starting, with the reason shown in Settings, so correct it before upgrading. The URLs advertised over OIDC now match that public URL even when the server is reached over internal HTTP behind a proxy (2026-08-27).
• Web search is more restrained: a provider that has just served a human-verification page is set aside for a while, the same query is not repeated within a short window, uploaded files are no longer all read up front, and the number of searches a task should need is given as a budget (2026-08-27).
• The LLM Gateway's OpenAI-compatible /chat/completions streams only when stream: true is set, matching the OpenAI default, instead of streaming whenever stream was omitted. External clients that relied on the old behavior should set stream: true explicitly (2026-08-26).
• When a conversation hits the model's context limit, the hand-off to the next step replaces the conversation with a summary rather than passing the oversized history plus a summary, which made the receiving step hit the limit again immediately. A verify step that hits the limit completes the task with the summary instead of discarding finished work; steps that have not produced an answer yet still abort and retry (2026-08-18).
• Office files are rejected before being opened when their contents do not match the declared type, or when they would expand far beyond their stored size, at every entry point rather than only the main one (2026-08-12).
• A fresh install that listens on an externally reachable address (Docker does) creates an admin account at startup and prints the password to the startup log and data/.initial-admin-password, instead of coming up with no authentication at all. Changing the password stops the log output, and a warning bar appears if authentication is left off while exposed (2026-08-03).
• The LLM Gateway authenticates only keys that have been issued and recorded, so every call is attributed; keys written in config.yaml are imported at startup and keep working. Usage is now recorded for external clients too, and gateway callers appear in the worker view (2026-07-30).
• Pieces are called workflows in the interface and their movements are called steps, replacing the mix of "Piece", "piece" and "task type" that appeared in different places. Only the wording changed (2026-07-29).
• Database migrations are applied before the server process starts, and a migration failure stops the boot with the error on the console rather than leaving a half-updated database running (2026-07-14).

Removed

• The slide, brainstorming and ssh-ops workflows were retired — each had been run a couple of times in total, and a longer catalogue makes automatic routing less accurate. Nothing became impossible: the tools remain, so the same requests work in chat. The interactive ssh-console workflow stays (2026-08-12).
• The database-less Gateway startup mode (AAO_GATEWAY_NO_DB) is gone. It existed to authenticate against keys in the config file, which is no longer a supported route (2026-07-30).
• Per-task share links are gone; sharing is by workspace. Add people as members or send an invite link. Opening an already-issued task link explains the change (2026-07-29).

Fixed

• A failing MCP server says why: a connection error after saving a server is reported instead of only reaching the server log, "Refresh tools" failures are classified (HTTPS required, private IP blocked, name resolution, connection refused, HTTP status, authentication, timeout) with the next step spelled out, a server whose tools were never fetched is marked unverified, and both calls honor a timeout instead of hanging for minutes (2026-09-17).
• Log cleanup no longer removes another chat's records, and SSH operations left "running" by a restart are reconciled (2026-09-12).
• A broken or unresponsive web page no longer holds up a read, a model that returns nothing no longer keeps a task waiting for tens of minutes, and browser pages opened behind web search are closed instead of accumulating (2026-09-11).
• "Max stream time (minutes)" from Settings is actually applied (2026-09-08).
• A turn that produced only reasoning is no longer aborted as an empty response, and a continued task no longer rebuilds the same summary each time (2026-09-07).
• Several controls were unreadable in one of the two themes — the SSH console tab strip and its close buttons, delete buttons in Settings, dialog backdrops, and a handful of labels that matched their background (2026-09-05).
• One unreadable entry or one dangling link no longer hides an entire folder in the Files tab, in the workspace file list or in a shared app (2026-08-31).
• Mermaid diagrams render sharply and a diagram that failed to draw is no longer delivered as-is, and right-clicking no longer clears the text you had just selected (2026-08-25).
• Passwords typed during browser automation are no longer written verbatim to the browser operation log (2026-08-20).
• LLM backends behave consistently again: a worker no longer silently runs a different model than the one configured, backends that omit tool-call identifiers no longer collide with the ones generated for them, vLLM behind the Gateway works, a vLLM worker's context limit is read from the value it was launched with, and a task connected to a hosted AI service no longer drops out mid-run (2026-08-20).
• Reading a workbook now always reports the sheets it contains and marks the ones it could not read, instead of leaving the agent to believe a multi-sheet file had only the first sheet once the cell budget ran out. Large PDFs no longer lose content, and a task that had read an image no longer stalls on its follow-up run or loses that image permanently (2026-08-17).
• A single unreadable attachment no longer keeps a task from finishing, and invented tool names no longer appear in a run (2026-08-13).
• Reflection no longer saves a workflow that would not load, and it works again on the backends where it had been failing (2026-08-12).
• The server no longer starts without authentication when its config file cannot be read, and a queued task with no eligible worker says so in the UI instead of sitting silently (2026-08-10).
• The agent can use Python for spreadsheets, plots and images again, and generated SSH keys are always usable (2026-08-09).
• Deleting a task now clears its subtask records too, and subtasks no longer leak between tasks (2026-07-31).
• X (Twitter) search and post retrieval work again (2026-07-21).
• The Movement Map's "go to this movement" control lands on the right step, search result cards stay attached to the answer instead of disappearing, and an image pasted into a message sent while the agent is working is linked to that message so the agent reads the file it was meant to (2026-07-18).
• Model selection menus no longer get clipped by the chat viewport, and the “jump to latest” control stays anchored above the composer (2026-07-12).
• Pet and star animations now retain stable identities and smoother timing, reducing flicker and visible jumps around worker activity (2026-07-12).
• Repeated Slack mention events no longer create duplicate tasks or replies, and connector status and failure feedback are clearer in Settings (2026-07-12).
• Delegate run cards showed "0 tool calls" (and empty tool/file breakdowns) regardless of actual activity; tool events now carry their own run attribution (2026-07-09).

v0.2.0 (2026-07-09)

A month of work since the initial release, centered on shared workspaces, agent-to-agent (A2A) collaboration, and much deeper visibility into what agents are doing.

Added

• Shared workspaces — the workspace is now the single home for everything: a workspace rail, per-workspace chats with search/filtering, colors and descriptions, running-count badges, workspace-scoped schedules, reusable invite links, and credential sharing with scoped grants. The separate "Tasks" tab is gone.
• Workspace tool policy — enable/disable tools per workspace from Settings → Tools; piece YAML no longer controls tool availability. Agents can request a missing tool or Python package mid-task and use it as soon as you approve in chat; workspaces can also pre-install extra Python packages.
• A2A protocol support — publish an Agent Card, delegate skills to external agents with per-delegation resource limits, run long A2A tasks non-blocking, and list/revoke delegations from Settings (OAuth-based authorization server underneath).
• SSH integration — register SSH connections per workspace, run one-shot remote operations, or open an interactive console where you and the agent share one PTY (multiple sessions with tab switching).
• Delegate observability — sub-agent (delegate) runs are now visible: live cards with the currently running tool, result previews and abort reasons, LLM token counts, child-run rollups, and a live console. LLM execution itself shows live state, attempt badges, and classified interruption reasons.
• Workspace apps — self-contained HTML mini-apps that read/write workspace files, generated with starter templates and a self-E2E pass, shareable via read-only public links.
• Files tab upgrades — folder create/rename/move/delete/download, drag-and-drop organization, touch support, a details view (size, modified time), file provenance (which task created a file), a protected readonly/ area, and automatic recognition of files you drop into the workspace.
• Richer previews and reading — Excel/PowerPoint/Word preview, PDF page-range reads, and a single Read tool that auto-detects .xlsx/.docx/.pdf/.pptx/.msg.
• X (Twitter) research — tools restored (new transaction-id scheme), home timeline support, full text of long-form X Articles, and an "SNS deep sweep" piece that triages a timeline and deep-dives each post with a clean-context sub-agent.
• Cross-task recall — agents can search other chats in the workspace (SearchWorkspaceTasks), search their own long conversations, and subtasks can look back at their own transcript; multi-keyword AND search included.
• Memory & learning — lessons captured mid-task into persistent memory / AGENTS.md, a Memory & Learning settings tab with reflection history and revert, and an extended mission brief that pins user constraints and decisions.
• English UI — recently added screens are fully localized (i18next); UI is bilingual Japanese/English throughout.

Changed

• Chat screen: taller conversation viewport, a card-style auto-growing composer, an always-visible context-usage gauge, and tool rows with execution timestamps.
• Research pieces split large investigations into serial delegate runs to keep the orchestrator context small.
• Context handling keeps more of the recent conversation verbatim when compacting and retains longer histories on large-context models.
• Job time limits are configurable from Settings, with clearer hard-kill reasons (default 180 minutes).

Fixed

• A context-limit livelock that aborted tasks seconds after start with "max iterations (200) exceeded" while doing no work.
• Docker: clean docker compose up --build reliably installs Chromium (npm bin-name collision), and Windows/WSL2 checkouts build cleanly (.env optional, LF pinned via .gitattributes).
• HTTPS redirect kept firing after HSTS was disabled (sticky-HSTS opt-in fix).
• Shift_JIS and other non-UTF-8 Japanese text was misdetected as binary; BOM handling fixed.
• Raw HTML in chat messages no longer breaks the conversation layout.
• Models that require the system message first no longer error mid-task.
• Skills whose folder name diverged from their display name could not be deleted or edited.
• Attaching a file with an existing name no longer overwrites it silently — the old version is evacuated to old/.

v0.1.0 — Initial public release (2026-06-02)

First open-source release of MAESTRO, an agent orchestration platform:

• Runs tasks against any OpenAI-compatible LLM endpoint (Ollama, vLLM, …).
• LLM-classified task routing into Pieces (YAML workflows) of movements.
• Sandboxed tool runtime (Read/Write/Edit/Bash/Glob/Grep, Office, Web, Browser, Image, Data/SQLite, Knowledge/RAG, SSH, MCP, sub-tasks, and more).
• Bash tool sandbox (bwrap-based filesystem/network/env isolation with a hardened fallback) and a declarative pre-baked Python toolchain.
• Optional LLM Gateway (virtual keys, budgets, metrics), reflection-based learning, scheduled tasks, and a React web UI.
• Apache-2.0 licensed.